2019 CVEs¶
58 entries from 2019. 0 ship detection & prevention rules.
| CVE | Severity | Detection / prevention | PoC |
|---|---|---|---|
| CVE-2019-11708 — Insufficient vetting of parameters passed with the Prompt:Open IPC message between child… | Critical (10.0) | — | ✅ |
| CVE-2019-7609 — Kibana versions before 5.6.15 and 6.6.1 contain an arbitrary code execution flaw in the… | Critical (10.0) | — | ✅ |
| CVE-2019-1003029 — A sandbox bypass vulnerability exists in Jenkins Script Security Plugin 1.53 and earlier… | Critical (9.9) | — | ✅ |
| CVE-2019-1003030 — A sandbox bypass vulnerability exists in Jenkins Pipeline: Groovy Plugin 2.63 and earlier… | Critical (9.9) | — | ✅ |
| CVE-2019-10758 — mongo-express before 0.54.0 is vulnerable to Remote Code Execution via endpoints that… | Critical (9.9) | — | ✅ |
| CVE-2019-0344 — Due to unsafe deserialization used in SAP Commerce Cloud (virtualjdbc extension),… | Critical (9.8) | — | ✅ |
| CVE-2019-0604 — A remote code execution vulnerability exists in Microsoft SharePoint when the software… | Critical (9.8) | — | ✅ |
| CVE-2019-0708 — A remote code execution vulnerability exists in Remote Desktop Services formerly known as… | Critical (9.8) | — | ✅ |
| CVE-2019-10068 — An issue was discovered in Kentico 12.0.x before 12.0.15, 11.0.x before 11.0.48, 10.0.x… | Critical (9.8) | — | ✅ |
| CVE-2019-10149 — A flaw was found in Exim versions 4.87 to 4.91 (inclusive). | Critical (9.8) | — | ✅ |
| CVE-2019-11580 — Atlassian Crowd and Crowd Data Center had the pdkinstall development plugin incorrectly… | Critical (9.8) | — | ✅ |
| CVE-2019-11581 — There was a server-side template injection vulnerability in Jira Server and Data Center,… | Critical (9.8) | — | ✅ |
| CVE-2019-11634 — Citrix Workspace App before 1904 for Windows has Incorrect Access Control. | Critical (9.8) | — | ✅ |
| CVE-2019-12989 — Citrix SD-WAN 10.2.x before 10.2.3 and NetScaler SD-WAN 10.0.x before 10.0.8 allow SQL… | Critical (9.8) | — | ✅ |
| CVE-2019-15107 — An issue was discovered in Webmin <=1.920. | Critical (9.8) | — | ✅ |
| CVE-2019-16057 — The login_mgr.cgi script in D-Link DNS-320 through 2.05.B10 is vulnerable to remote… | Critical (9.8) | — | ✅ |
| CVE-2019-16256 — Some Samsung devices include the SIMalliance Toolbox Browser (aka S@T Browser) on the… | Critical (9.8) | — | ✅ |
| CVE-2019-16278 — Directory Traversal in the function http_verify in nostromo nhttpd through 1.9.6 allows… | Critical (9.8) | — | ✅ |
| CVE-2019-16759 — vBulletin 5.x through 5.5.4 allows remote command execution via the widgetConfig[code]… | Critical (9.8) | — | ✅ |
| CVE-2019-16920 — Unauthenticated remote code execution occurs in D-Link products such as DIR-655C,… | Critical (9.8) | — | ✅ |
| CVE-2019-16928 — Exim 4.92 through 4.92.2 allows remote code execution, a different vulnerability than… | Critical (9.8) | — | ✅ |
| CVE-2019-17621 — The UPnP endpoint URL /gena.cgi in the D-Link DIR-859 Wi-Fi router 1.05 and 1.06B01… | Critical (9.8) | — | ✅ |
| CVE-2019-18935 — Progress Telerik UI for ASP.NET AJAX through 2019.3.1023 contains a .NET deserialization… | Critical (9.8) | — | ✅ |
| CVE-2019-19781 — An issue was discovered in Citrix Application Delivery Controller (ADC) and Gateway 10.5,… | Critical (9.8) | — | ✅ |
| CVE-2019-2725 — Vulnerability in the Oracle WebLogic Server component of Oracle Fusion Middleware… | Critical (9.8) | — | ✅ |
| CVE-2019-3396 — The Widget Connector macro in Atlassian Confluence Server before version 6.6.12 (the… | Critical (9.8) | — | ✅ |
| CVE-2019-3568 — A buffer overflow vulnerability in WhatsApp VOIP stack allowed remote code execution via… | Critical (9.8) | — | ✅ |
| CVE-2019-3929 — The Crestron AM-100 firmware 1.6.0.2, Crestron AM-101 firmware 2.7.0.1, Barco wePresent… | Critical (9.8) | — | ✅ |
| CVE-2019-4716 — IBM Planning Analytics 2.0.0 through 2.0.8 is vulnerable to a configuration overwrite… | Critical (9.8) | — | ✅ |
| CVE-2019-5544 — OpenSLP as used in ESXi and the Horizon DaaS appliances has a heap overwrite issue. | Critical (9.8) | — | ✅ |
| CVE-2019-7192 — This improper access control vulnerability allows remote attackers to gain unauthorized… | Critical (9.8) | — | ✅ |
| CVE-2019-7193 — This improper input validation vulnerability allows remote attackers to inject arbitrary… | Critical (9.8) | — | ✅ |
| CVE-2019-7194 — This external control of file name or path vulnerability allows remote attackers to… | Critical (9.8) | — | ✅ |
| CVE-2019-7195 — This external control of file name or path vulnerability allows remote attackers to… | Critical (9.8) | — | ✅ |
| CVE-2019-7238 — Sonatype Nexus Repository Manager before 3.15.0 has Incorrect Access Control. | Critical (9.8) | — | ✅ |
| CVE-2019-7256 — CVE ID: CVE-2019-7256, CWE: CWE-78, Type: RCE, Attack Vector: NETWORK, CVSS: 9.8 | Critical (9.8) | — | ✅ |
| CVE-2019-9670 — mailboxd component in Synacor Zimbra Collaboration Suite 8.7.x before 8.7.11p10 has an… | Critical (9.8) | — | ✅ |
| CVE-2019-9874 — Deserialization of Untrusted Data in the Sitecore.Security.AntiCSRF (aka anti CSRF)… | Critical (9.8) | — | ✅ |
| CVE-2019-0541 — A remote code execution vulnerability exists in the way that the MSHTML engine inproperly… | High (8.8) | — | ✅ |
| CVE-2019-0903 — A remote code execution vulnerability exists in the way that the Windows Graphics Device… | High (8.8) | — | ✅ |
| CVE-2019-11707 — A type confusion vulnerability can occur when manipulating JavaScript objects due to… | High (8.8) | — | ✅ |
| CVE-2019-1297 — A remote code execution vulnerability exists in Microsoft Excel software when the… | High (8.8) | — | ✅ |
| CVE-2019-12991 — Citrix SD-WAN 10.2.x before 10.2.3 and NetScaler SD-WAN 10.0.x before 10.0.8 have… | High (8.8) | — | ✅ |
| CVE-2019-13720 — Use after free in WebAudio in Google Chrome prior to 78.0.3904.87 allowed a remote… | High (8.8) | — | ✅ |
| CVE-2019-15271 — A vulnerability in the web-based management interface of certain Cisco Small Business RV… | High (8.8) | — | ✅ |
| CVE-2019-15949 — Nagios XI before 5.6.6 allows remote command execution as root. | High (8.8) | — | ✅ |
| CVE-2019-17026 — Incorrect alias information in IonMonkey JIT compiler for setting array elements could… | High (8.8) | — | ✅ |
| CVE-2019-3010 — Vulnerability in the Oracle Solaris product of Oracle Systems (component: XScreenSaver). | High (8.8) | — | ✅ |
| CVE-2019-3398 — Confluence Server and Data Center had a path traversal vulnerability in the… | High (8.8) | — | ✅ |
| CVE-2019-8720 — A vulnerability was found in WebKit. | High (8.8) | — | ✅ |
| CVE-2019-9082 — ThinkPHP before 3.2.4, as used in Open Source BMS v1.1.1 and other products, allows… | High (8.8) | — | ✅ |
| CVE-2019-9875 — Deserialization of Untrusted Data in the anti CSRF module in Sitecore through 9.1 allows… | High (8.8) | — | ✅ |
| CVE-2019-11043 — In PHP versions 7.1.x below 7.1.33, 7.2.x below 7.2.24 and 7.3.x below 7.3.11 in certain… | High (8.7) | — | ✅ |
| CVE-2019-18426 — A vulnerability in WhatsApp Desktop versions prior to 0.3.9309 when paired with WhatsApp… | High (8.2) | — | ✅ |
| CVE-2019-1579 — Remote Code Execution in PAN-OS 7.1.18 and earlier, PAN-OS 8.0.11-h1 and earlier, and… | High (8.1) | — | ✅ |
| CVE-2019-6340 — Some field types do not properly sanitize data from non-form sources in Drupal 8.5.x… | High (8.1) | — | ✅ |
| CVE-2019-11510 — CVE ID: CVE-2019-11510, CWE: CWE-22, Type: PATH_TRAVERSAL, Attack Vector: NETWORK, CVSS:… | Unrated | — | ✅ |
| CVE-2019-8506 — CVE ID: CVE-2019-8506, CWE: CWE-843, Attack Vector: NETWORK, CVSS: 8.8 | Unrated | — | ✅ |